568

I am looking to use Java to get the MD5 checksum of a file. I was really surprised but I haven't been able to find anything that shows how to get the MD5 checksum of a file.

How is it done?

5
  • 1
    Maybe this will help. You could also look up the spec but that would take more doing as it's complicated. Nov 20, 2008 at 3:49
  • 4
    Keep in mind that according to the recent research "MD5 should be considered cryptographically broken and unsuitable for further use". en.wikipedia.org/wiki/MD5 May 3, 2013 at 1:06
  • 97
    MD5 is no longer considered cryptographically secure, but it's still sufficient for validating file consistency and it's faster than SHA.
    – jiggy
    Jun 30, 2013 at 22:12
  • 4
    @ZakhariaStanley This is a question about checksumming.
    – iPherian
    May 3, 2017 at 19:26
  • 2
    The canonical use for MD5 checksums on files is to avoid hostile replacements of distributed files. That's where it is unsecure. But in a scenario where hostile exploits are not a concern, it's perfectly suitable. Oct 4, 2018 at 0:05

22 Answers 22

609

There's an input stream decorator, java.security.DigestInputStream, so that you can compute the digest while using the input stream as you normally would, instead of having to make an extra pass over the data.

MessageDigest md = MessageDigest.getInstance("MD5");
try (InputStream is = Files.newInputStream(Paths.get("file.txt"));
     DigestInputStream dis = new DigestInputStream(is, md)) 
{
  /* Read decorated stream (dis) to EOF as normal... */
}
byte[] digest = md.digest();
26
  • 5
    I agree, very elegant way to calculate the checksum on the fly if you're already doing something with the bytes (i.e. reading them in on from an HTTP connection). Dec 6, 2008 at 1:51
  • 2
    @AlPhaba Did you declare the is as an InputStream or a FileInputStream? Sounds like you used FileInputStream, which would cause this error.
    – erickson
    Dec 17, 2012 at 17:16
  • 1
    @barwnikk It works fine in Java 8. MethodNotFound is not an exception from standard Java; perhaps you are talking about a compiler error? In any case, if it doesn't work for you, it's a local configuration problem, or a problem with other code.
    – erickson
    Jun 23, 2014 at 18:45
  • 4
    @barwnikk Again, that is your local configuration problem. This is valid Java 7 and Java 8 code. If you are stuck with tools from 2006, you'll have to adapt.
    – erickson
    Jul 7, 2014 at 15:41
  • 5
    @erickson You are not updating the MessageDigest object with the file content. Rt ? This code will print always a same digest.
    – sunil
    Oct 31, 2014 at 8:16
340

Use DigestUtils from Apache Commons Codec library:

try (InputStream is = Files.newInputStream(Paths.get("file.zip"))) {
    String md5 = org.apache.commons.codec.digest.DigestUtils.md5Hex(is);
}
8
  • 1
    Doesn't work for me in my android code I get this error...java.lang.NoSuchMethodError: org.apache.commons.codec.binary.Hex.encodeHexString at org.apache.commons.codec.digest.DigestUtils.md5Hex(DigestUtils.java:215)
    – JPM
    May 1, 2012 at 21:03
  • @JPM Presume you downloaded and put the commons-codec.jar on your classpath already? May 1, 2012 at 21:07
  • yes there and I exported in my android project..I can step through the code and the class is there in the source files...weird, must be some android Eclipse issue.
    – JPM
    May 1, 2012 at 21:08
  • 1
    I had the same problem, but it fixed by this code ` FileInputStream fis = new FileInputStream(new File(filePath)); byte data[] = org.apache.commons.codec.digest.DigestUtils.md5(fis); char md5Chars[] = Hex.encodeHex(data); String md5 = String.valueOf(md5Chars);`
    – Dmitry_L
    Jul 17, 2013 at 10:45
  • 3
    Nice! For new projects I always think twice before adding a new dependency but for existing project I just have to check if the library is already there to use it. +1
    – OscarRyz
    Jul 31, 2013 at 20:45
176

There's an example at Real's Java-How-to using the MessageDigest class.

Check that page for examples using CRC32 and SHA-1 as well.

import java.io.*;
import java.security.MessageDigest;

public class MD5Checksum {

   public static byte[] createChecksum(String filename) throws Exception {
       InputStream fis =  new FileInputStream(filename);

       byte[] buffer = new byte[1024];
       MessageDigest complete = MessageDigest.getInstance("MD5");
       int numRead;

       do {
           numRead = fis.read(buffer);
           if (numRead > 0) {
               complete.update(buffer, 0, numRead);
           }
       } while (numRead != -1);

       fis.close();
       return complete.digest();
   }

   // see this How-to for a faster way to convert
   // a byte array to a HEX string
   public static String getMD5Checksum(String filename) throws Exception {
       byte[] b = createChecksum(filename);
       String result = "";

       for (int i=0; i < b.length; i++) {
           result += Integer.toString( ( b[i] & 0xff ) + 0x100, 16).substring( 1 );
       }
       return result;
   }

   public static void main(String args[]) {
       try {
           System.out.println(getMD5Checksum("apache-tomcat-5.5.17.exe"));
           // output :
           //  0bb2827c5eacf570b6064e24e0e6653b
           // ref :
           //  http://www.apache.org/dist/
           //          tomcat/tomcat-5/v5.5.17/bin
           //              /apache-tomcat-5.5.17.exe.MD5
           //  0bb2827c5eacf570b6064e24e0e6653b *apache-tomcat-5.5.17.exe
       }
       catch (Exception e) {
           e.printStackTrace();
       }
   }
}
9
  • 75
    Yep ... still on-line after 11 years! :-)
    – RealHowTo
    Nov 21, 2008 at 2:41
  • The example at Real's Java-How-To works perfectly, and was simple to implement.
    – bakoyaro
    Jun 27, 2011 at 14:30
  • The read loop is a little clumsy. read() won't return zero, and a do/while isn't really appropriate.
    – user207421
    Aug 16, 2015 at 7:43
  • 10
    @EJP Thanks for your timely feedback. Aug 16, 2015 at 12:46
  • byte[] buffer = new byte[1024]; can we change the size from 1024 to something more optimal?
    – Jalpesh
    Jun 2, 2016 at 8:43
93

The com.google.common.hash API offers:

  • A unified user-friendly API for all hash functions
  • Seedable 32- and 128-bit implementations of murmur3
  • md5(), sha1(), sha256(), sha512() adapters, change only one line of code to switch between these, and murmur.
  • goodFastHash(int bits), for when you don't care what algorithm you use
  • General utilities for HashCode instances, like combineOrdered / combineUnordered

Read the User Guide (IO Explained, Hashing Explained).

For your use-case Files.hash() computes and returns the digest value for a file.

For example a digest calculation (change SHA-1 to MD5 to get MD5 digest)

HashCode hc = Files.asByteSource(file).hash(Hashing.sha1());
"SHA-1: " + hc.toString();

Note that is much faster than , so use if you do not need a cryptographically secure checksum. Note also that should not be used to store passwords and the like since it is to easy to brute force, for passwords use , or instead.

For long term protection with hashes a Merkle signature scheme adds to the security and The Post Quantum Cryptography Study Group sponsored by the European Commission has recommended use of this cryptography for long term protection against quantum computers (ref).

Note that has a higher collision rate than the others.

3
  • What part of Files.hash as stated above does not cover Files.hash ?
    – oluies
    Feb 25, 2015 at 22:57
  • 2
    The Files.hash() is marked as deprecated, the recommended way is: Files.asByteSource(file).hash(Hashing.sha1())
    – erkfel
    Dec 15, 2017 at 20:53
  • 1
    And as of January 2018 Hashing.sha1() is marked deprecated. The function Hashing.sha256() is recommended instead. source Mar 20, 2018 at 11:28
84

Using nio2 (Java 7+) and no external libraries:

byte[] b = Files.readAllBytes(Paths.get("/path/to/file"));
byte[] hash = MessageDigest.getInstance("MD5").digest(b);

To compare the result with an expected checksum:

String expected = "2252290BC44BEAD16AA1BF89948472E8";
String actual = DatatypeConverter.printHexBinary(hash);
System.out.println(expected.equalsIgnoreCase(actual) ? "MATCH" : "NO MATCH");
3
  • @Arash yes absolutely - thanks. I mixed up the JDK Files class and Guava's.
    – assylias
    May 23, 2016 at 10:30
  • I like this solution more than erickson's since it can be wrapped with Optionals to use pure Functional style programming Sep 24, 2018 at 16:19
  • 13
    For a big file this will use a lot of memory since the whole file is read and then fed to the digest instead of reading chunks and "digesting" them as they are read.
    – bernie
    Dec 3, 2018 at 17:00
45

Guava now provides a new, consistent hashing API that is much more user-friendly than the various hashing APIs provided in the JDK. See Hashing Explained. For a file, you can get the MD5 sum, CRC32 (with version 14.0+) or many other hashes easily:

HashCode md5 = Files.hash(file, Hashing.md5());
byte[] md5Bytes = md5.asBytes();
String md5Hex = md5.toString();

HashCode crc32 = Files.hash(file, Hashing.crc32());
int crc32Int = crc32.asInt();

// the Checksum API returns a long, but it's padded with 0s for 32-bit CRC
// this is the value you would get if using that API directly
long checksumResult = crc32.padToLong();
1
  • 1
    Files.hash is deprecated, use Files.asByteSource(new File("")).hash(Hashing.md5()) now
    – RedShift
    Jul 11, 2022 at 12:48
34

Ok. I had to add. One line implementation for those who already have Spring and Apache Commons dependency or are planning to add it:

DigestUtils.md5DigestAsHex(FileUtils.readFileToByteArray(file))

For and Apache commons only option (credit @duleshi):

DigestUtils.md5Hex(FileUtils.readFileToByteArray(file))

Hope this helps someone.

3
  • 1
    It's DigestUtils.md5Hex(FileUtils.readFileToByteArray(file))
    – duleshi
    Aug 7, 2015 at 6:34
  • David Onter commons based solution is better because it doesn't read a whole file into memory. Mar 18, 2018 at 1:12
  • At least for Spring 5 you have DigestUtils.md5Digest(InputStream inputStream) to calculate the MD5 digest and DigestUtils.md5DigestAsHex(InputStream inputStream) for hexadecimal string representation of the MD5 digest methods without read a whole file into memory. Sep 20, 2018 at 2:58
27

A simple approach with no third party libraries using Java 7

String path = "your complete file path";
MessageDigest md = MessageDigest.getInstance("MD5");
md.update(Files.readAllBytes(Paths.get(path)));
byte[] digest = md.digest();

If you need to print this byte array. Use as below

System.out.println(Arrays.toString(digest));

If you need hex string out of this digest. Use as below

String digestInHex = DatatypeConverter.printHexBinary(digest).toUpperCase();
System.out.println(digestInHex);

where DatatypeConverter is javax.xml.bind.DatatypeConverter

3
  • Why the toUpperCase? Dec 26, 2015 at 13:53
  • @edgecaseberg just for the hex string look good while printing it to console
    – sunil
    Dec 26, 2015 at 17:47
  • I found I needed to use toLowerCase() instead of toUpperCase().
    – Splendor
    Feb 24, 2016 at 17:59
14

I recently had to do this for just a dynamic string, MessageDigest can represent the hash in numerous ways. To get the signature of the file like you would get with the md5sum command I had to do something like the this:

try {
   String s = "TEST STRING";
   MessageDigest md5 = MessageDigest.getInstance("MD5");
   md5.update(s.getBytes(),0,s.length());
   String signature = new BigInteger(1,md5.digest()).toString(16);
   System.out.println("Signature: "+signature);

} catch (final NoSuchAlgorithmException e) {
   e.printStackTrace();
}

This obviously doesn't answer your question about how to do it specifically for a file, the above answer deals with that quiet nicely. I just spent a lot of time getting the sum to look like most application's display it, and thought you might run into the same trouble.

2
  • The signature is the digest in hexadecimal format. I too found the hexadecimal representation to work where, as you say, other representations do not work. Thank you for putting this up.
    – amit kumar
    Oct 12, 2009 at 9:33
  • 1
    This is good, but .toString(16) will throw away leading zeros. String.format("%032x", ...) may be better.
    – Harold
    Jun 10, 2020 at 15:37
13
public static void main(String[] args) throws Exception {
    MessageDigest md = MessageDigest.getInstance("MD5");
    FileInputStream fis = new FileInputStream("c:\\apache\\cxf.jar");

    byte[] dataBytes = new byte[1024];

    int nread = 0;
    while ((nread = fis.read(dataBytes)) != -1) {
        md.update(dataBytes, 0, nread);
    };
    byte[] mdbytes = md.digest();
    StringBuffer sb = new StringBuffer();
    for (int i = 0; i < mdbytes.length; i++) {
        sb.append(Integer.toString((mdbytes[i] & 0xff) + 0x100, 16).substring(1));
    }
    System.out.println("Digest(in hex format):: " + sb.toString());
}

Or you may get more info http://www.asjava.com/core-java/java-md5-example/

1
  • THIS ANSWER is good I spent 12 hr before use this answer to achieve what i want many thanks :) Mar 5, 2021 at 12:53
10

We were using code that resembles the code above in a previous post using

...
String signature = new BigInteger(1,md5.digest()).toString(16);
...

However, watch out for using BigInteger.toString() here, as it will truncate leading zeros... (for an example, try s = "27", checksum should be "02e74f10e0327ad868d138f2b4fdd6f0")

I second the suggestion to use Apache Commons Codec, I replaced our own code with that.

1
  • 1
    Wow, I was looking into an issue where the MD5 stuff was working perfectly for everything, except a file was giving us only a 31 hex digit output, and was failing the md5checksums. that truncating of leading 0s is a huge pain... Thanks for your note.
    – Mike
    Mar 1, 2012 at 18:11
9
public static String MD5Hash(String toHash) throws RuntimeException {
   try{
       return String.format("%032x", // produces lower case 32 char wide hexa left-padded with 0
      new BigInteger(1, // handles large POSITIVE numbers 
           MessageDigest.getInstance("MD5").digest(toHash.getBytes())));
   }
   catch (NoSuchAlgorithmException e) {
      // do whatever seems relevant
   }
}
0
9

Very fast & clean Java-method that doesn't rely on external libraries:

(Simply replace MD5 with SHA-1, SHA-256, SHA-384 or SHA-512 if you want those)

public String calcMD5() throws Exception{
        byte[] buffer = new byte[8192];
        MessageDigest md = MessageDigest.getInstance("MD5");

        DigestInputStream dis = new DigestInputStream(new FileInputStream(new File("Path to file")), md);
        try {
            while (dis.read(buffer) != -1);
        }finally{
            dis.close();
        }

        byte[] bytes = md.digest();

        // bytesToHex-method
        char[] hexChars = new char[bytes.length * 2];
        for ( int j = 0; j < bytes.length; j++ ) {
            int v = bytes[j] & 0xFF;
            hexChars[j * 2] = hexArray[v >>> 4];
            hexChars[j * 2 + 1] = hexArray[v & 0x0F];
        }

        return new String(hexChars);
}
1
  • 1
    The "bytesToHex" bit can be replaced with new BigInteger(1, bytes).toString(16).
    – assylias
    Apr 5, 2021 at 14:46
9

Here is a handy variation that makes use of InputStream.transferTo() from Java 9, and OutputStream.nullOutputStream() from Java 11. It requires no external libraries and does not need to load the entire file into memory.

public static String hashFile(String algorithm, File f) throws IOException, NoSuchAlgorithmException {
    MessageDigest md = MessageDigest.getInstance(algorithm);

    try(BufferedInputStream in = new BufferedInputStream((new FileInputStream(f)));
        DigestOutputStream out = new DigestOutputStream(OutputStream.nullOutputStream(), md)) {
        in.transferTo(out);
    }

    String fx = "%0" + (md.getDigestLength()*2) + "x";
    return String.format(fx, new BigInteger(1, md.digest()));
}

and

hashFile("SHA-512", Path.of("src", "test", "resources", "some.txt").toFile());

returns

"e30fa2784ba15be37833d569280e2163c6f106506dfb9b07dde67a24bfb90da65c661110cf2c5c6f71185754ee5ae3fd83a5465c92f72abd888b03187229da29"
8
String checksum = DigestUtils.md5Hex(new FileInputStream(filePath));
0
6

Another implementation: Fast MD5 Implementation in Java

String hash = MD5.asHex(MD5.getHash(new File(filename)));
1
  • I cannot find the method MD5.asHex() in JDK 1.8.0 242.
    – cbaldan
    Feb 12, 2020 at 16:12
6

Standard Java Runtime Environment way:

public String checksum(File file) {
  try {
    InputStream fin = new FileInputStream(file);
    java.security.MessageDigest md5er =
        MessageDigest.getInstance("MD5");
    byte[] buffer = new byte[1024];
    int read;
    do {
      read = fin.read(buffer);
      if (read > 0)
        md5er.update(buffer, 0, read);
    } while (read != -1);
    fin.close();
    byte[] digest = md5er.digest();
    if (digest == null)
      return null;
    String strDigest = "0x";
    for (int i = 0; i < digest.length; i++) {
      strDigest += Integer.toString((digest[i] & 0xff) 
                + 0x100, 16).substring(1).toUpperCase();
    }
    return strDigest;
  } catch (Exception e) {
    return null;
  }
}

The result is equal of linux md5sum utility.

6

Here is a simple function that wraps around Sunil's code so that it takes a File as a parameter. The function does not need any external libraries, but it does require Java 7.

import java.io.File;
import java.io.IOException;
import java.nio.file.Files;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

import javax.xml.bind.DatatypeConverter;

public class Checksum {

    /**
     * Generates an MD5 checksum as a String.
     * @param file The file that is being checksummed.
     * @return Hex string of the checksum value.
     * @throws NoSuchAlgorithmException
     * @throws IOException
     */
    public static String generate(File file) throws NoSuchAlgorithmException,IOException {

        MessageDigest messageDigest = MessageDigest.getInstance("MD5");
        messageDigest.update(Files.readAllBytes(file.toPath()));
        byte[] hash = messageDigest.digest();

        return DatatypeConverter.printHexBinary(hash).toUpperCase();
    }

    public static void main(String argv[]) throws NoSuchAlgorithmException, IOException {
        File file = new File("/Users/foo.bar/Documents/file.jar");          
        String hex = Checksum.generate(file);
        System.out.printf("hex=%s\n", hex);            
    }


}

Example output:

hex=B117DD0C3CBBD009AC4EF65B6D75C97B
1
  • This all nice when you use small files. For a 5gb file you'd be reading all of it into RAM, and as the docs state It is not intended for reading in large files.
    – Lorenzo
    Mar 30, 2022 at 16:48
3

If you're using ANT to build, this is dead-simple. Add the following to your build.xml:

<checksum file="${jarFile}" todir="${toDir}"/>

Where jarFile is the JAR you want to generate the MD5 against, and toDir is the directory you want to place the MD5 file.

More info here.

3

Google guava provides a new API. Find the one below :

public static HashCode hash(File file,
            HashFunction hashFunction)
                     throws IOException

Computes the hash code of the file using hashFunction.

Parameters:
    file - the file to read
    hashFunction - the hash function to use to hash the data
Returns:
    the HashCode of all of the bytes in the file
Throws:
    IOException - if an I/O error occurs
Since:
    12.0
2
public static String getMd5OfFile(String filePath)
{
    String returnVal = "";
    try 
    {
        InputStream   input   = new FileInputStream(filePath); 
        byte[]        buffer  = new byte[1024];
        MessageDigest md5Hash = MessageDigest.getInstance("MD5");
        int           numRead = 0;
        while (numRead != -1)
        {
            numRead = input.read(buffer);
            if (numRead > 0)
            {
                md5Hash.update(buffer, 0, numRead);
            }
        }
        input.close();

        byte [] md5Bytes = md5Hash.digest();
        for (int i=0; i < md5Bytes.length; i++)
        {
            returnVal += Integer.toString( ( md5Bytes[i] & 0xff ) + 0x100, 16).substring( 1 );
        }
    } 
    catch(Throwable t) {t.printStackTrace();}
    return returnVal.toUpperCase();
}
2

Pulling together ideas from other answers, here's simple code with no third party dependencies (or DatatypeConverter which is longer in the latest JDKs) that generates this as a hex string compatible with output of the md5sum tool:

import java.io.IOException;
import java.math.BigInteger;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
...

static String calculateMD5(String path) throws IOException
{
    try {
        MessageDigest md = MessageDigest.getInstance("MD5");
        md.update(Files.readAllBytes(Paths.get(path)));
        return String.format("%032x", new BigInteger(1, md.digest())); // hex, padded to 32 chars
    } catch (NoSuchAlgorithmException ex)
    {
        throw new RuntimeException(ex); // MD5 is always available so this should be impossible
    }
}
1
  • This is exactly what i needed. Matches md5sum.
    – Douy789
    Mar 2 at 17:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.